The Flaws in the Current Support System

This is not a rant, this is a serious discussion about why some people have been getting their email address unexpectedly changed. I'll be trying my best to explain this to non-security-oriented people.

Soo almost daily, we can expect to see such postings as: "I’ve been hacked again," "My email address was changed," or "I have 2FA enabled, but they were still able to get in."

Now, if these individuals, who I wanted to dispel a tremendous myth regarding the type of thefts which actually take place, why your security settings haven't been saving you, and why Supercell has failed to correct this exploit all these years..

It is (in most cases 97%) NOT a virus To begin, can the “I clicked on a link and received a virus” story please stop? Although phishing is real, the notion of a virus on one's phone “stealing” their Supercell ID is merely technologically implausible.

Both the ‘Android’ and ‘iOS’ operating systems employ “sandboxing” in order to ensure that no application accesses the information of other applications.

The feasibility of malware code targeting the Supercell login tokens is exceptionally hard to create., Which means the hacker did not break into your device.

The Real Threat is Social Engineering, The “hack” is actually nothing more than a person deceiving a Supercell Support representative. The process is alarmingly simple and perilously flawed: The hacker calls the customer support team, claiming they no longer have any "access to their account," which turns out to be your account. The support bot/agent requests “proving information” such as Clan name, Player Tag, and, importantly, country/location of account created.

As long as the attacker can locate your position (usually accomplished through IP grabbing links or simply through social media stalking), they can fool the agent into believing they are indeed the owner.

That is where it confuses all of us. “I had Account Protection on. 2FA!” 2FA secures the front door. It prevents people trying to log in with your password. Support Agents have a back door. When the agent has been convinced by the scammer, he alters the email address linked to that ID by hand. This ministry action completely circumvents your 2FA. This assumes the agent has verified the identity. Therefore, it completely disregards your security codes.

Tldr; This exploit has been known for years. Top players have been complaining about this since 2019. It's just a business decision. Supercell is weighing Security vs. Accessibility. That represents a huge portion of their player base: kids who all forget passwords, misplace e-mails, or just drop tablets.

If Supercell made the recovery process strict-actually requiring impossible-to-fake proof-millions of legit young players would get locked out forever; they would quit the game, and Supercell would lose revenue.,

They've done the math that it's more profitable to have a "loose" recovery system, which helps 99% of kids recover lost accounts, even if it means the top 1% of veteran players get their accounts socially engineered and stolen. out. They will abandon the game, which will cost more to Supercell in terms of lost income. And lastly, the brutal truth is that they have found that their profits would be higher with a “loose” recovery system where 99% of kids can easily restore their stolen accounts, although at the cost of socially engineering and stealing the accounts of the other 1% of the best gamers. I apologize for any grammatical mistakes.